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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1.704(b). 

Status 

Responsive to communication(s) filed on 22 May 2006 . 
2a)IEI This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 7-26 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration, 

5) D Claim(s) is/are allowed. 

6) [S] Claim(s) 1^26 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) [X] The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.n Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Claims 1-26 have been considered. Examiner has carefully considered Applicant's Remarks but 
maintains the rejections presented in the previous action. A response to arguments section concludes 
this action. 

5 

Specification 

The Specification is objected to in accordance with the 112, first paragraph, rejection below. 



Claim Rejections - 35 USC §112 

10 The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

15 

Claims 24-26 are rejected under 35 U.S.C. 112, first paragraph, as failing to comply with the 
written description requirement. The claim(s) contains subject matter which was not described in the 
specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor(s), 

20 at the time the application was filed, had possession of the claimed invention. Upon careful consideration 
of the Specification, Examiner fails to find the limitation "comparing the at least software operation with a 
repository of virus detection data" as described in line 5 of claim 24. In addition, Examiner submits that 
Applicant's amendments do not appear to be properly filed as Applicant has not specifically indicated 
support in the disclosure for new or amended claims (See MPEP 2163 II A). 

25 After review of the disclosure, Examiner finds teaching of language definition rules and language 

check rules. The language definition rules and the language check rules appear to be utilized to 
determine a virus. However, Examiner fails to find disclosure commensurate with the newly-added claim 
language, "comparing the at least software operation with a repository of virus detection data". Specific 
reference as to where this limitation is found in the Specification or appropriate correction is required. 



30 
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Claim Objections 

Claim 24 is objected to because of the following informalities: "the at least software operation" 
appears to be grammatically incorrect. Appropriate correction is required. 



5 Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for 
the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a 
10 printed publication in this or a foreign country, before the invention thereof by the applicant for a 

patent. 



Claims 1,4-9,13-16, and 19-26 are rejected under 35 U.S.C. 102(a) as being anticipated by 
15 Fermoyle, (Fermoyle, Ken. Firm Offers Free Tool to Fight love You' Virus. June 2000. Ottawa PC 
User's Group). 



As per claims 1,13-16, and 24, the applicant describes a method of detecting a script language 
virus comprising the following limitations which are met by Fermoyle: 
20 a) preparing language description data corresponding to at least one script language (paragraph 

8); 

b) preparing detection data for viral code corresponding to the script language virus (paragraph 

8); 

c) lexically analyzing a data stream using the language description data and the detection data to 
25 detect the viral code (paragraph 8); 



As per claims 4-6 and19-21, the applicant limits the method of claims 1 and 16, which are met by 
Fermoyle, with the following limitation which is also met by Fermoyle: 
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Wherein the language description data correspond to language definition rules and language 
check rules, wherein the language definition rules include descriptions of constructs of the target script 
language and relationships between the constructs (paragraph 8). 

As per claim 7, the applicant limits the method of claim 1 , which is met by Fermoyle (see above), 
with the following limitation which is also met by Fermoyle: 

Further comprising setting language definition rules for each of the at least one script language 
(paragraph 8); 

The MailMarshal uses language definition rules to search for particular keywords within the 

viruses. 

As per claims 8,9,22, and 25-26, the applicant limits claims 1,16, and 23, which are met by 
Fermoyle (see above), with the following limitation which is also met by Fermoyle: 

Wherein the detection data comprise at least one test, wherein each of the at least one test 
correspond to a pattern match or a cyclical redundancy check (paragraph 8). 

As per claims 1 0-1 1 , the applicant describes the method of claim 1 1 which is met by Fermoyle, 
with the following limitation which is also met by Fermoyle: 

Wherein the data stream is converted to a stream of tokens using lexical analysis (paragraph 8). 

As per claim 23, the applicant limits the apparatus of claim 16, which is met by Fermoyle (see 
above), with the following limitation which is also met by Fermoyle: 

Wherein detection engine converts the data stream to a stream of tokens using lexical analysis, 
and the tokens correspond to respective language constructs (paragraph 8). 



Claim Rejections - 35 USC § 103 
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The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
5 patented and the prior art are such that the subject matter as a whole would have been obvious 

at the time the invention was made to a person having ordinary skill in the art to which said 
subject matter pertains. Patentability shall not be negatived by the manner in which the invention 
was made. 

10 

Claims 2-3 and 17-18 are rejected under 35 U.S.C. 103(a) as being unpatentable over Fermoyle 
in view of Session (Session 19: Intro to Compiler Design: BNF, Recursion and Finite Automata. Fall 
1999. Computer Science Cource CS373. Retrieved from 

www.whitworth.edu/academic/Department/MathComputerScience/Courses/CS373 1999 Fall/Session 1 
15 9.doc ). 



As per claim 2-3 and 17-18, the applicant limits the method of claims 1 and 16, which are met by 
Fermoyle (see above), with the following limitation which is met by Session: 

Wherein the language description data correspond to Dynamic Finite Automata (Session: pages 

20 3-4); 

Fermoyle discloses all the limitations of claims 1 and 16. However, Fermoyle does not explicitly 
address that the language description data are dynamic finite automata. Session discloses the well- 
known idea in the art that lexical analysis may rely on dynamic finite automata in order to recognize 
tokens in a language. Furthermore, the dynamic finite automata may be used to construct string 

25 matchers. Combining the ideas of Session with those of Fermoyle allows the lexical analysis process to 
utilize dynamic finite automata. 

It would have been obvious to one of ordinary skill in the art at the time the invention was filed to 
combine the ideas of Session with those of Fermoyle because utilizing dynamic finite automata as 
suggested by Session in the lexical analysis process of Fermoyle would assist in the detection of viral 

30 code by providing an efficient means for recognizing tokens and constructing string matches. 
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Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over Fermoyle in view of the 
applicant's admitted prior art. 

5 As per claim 12, the applicant describes the method of claim 10, which is met by Fermoyle (see 

above), with the following limitation which is met by the applicant's admitted prior art: 

Wherein a cyclical redundancy check is performed on the stream of tokens to detect viral code 
(Specification: pages 3-4); 

As discussed by the applicant, one type of anti-virus technique is a cyclical redundancy check. 
10 As part of the cyclical redundancy check (CRC), unique CRC signature for each and every file to be 

protected is generates and stored. At a later time, a CRC error checking program determines whether a 
file has been tampered with or otherwise has become corrupted since the CRC signature was generated 
and stored, by generating a second CRC signature and then comparing the stored CRC signature with 
the second CRC signature. It would have been obvious to one of ordinary skill in the art at the time the 
1 5 invention was filed to combine the ideas of the applicant's admitted prior art with those of Fermoyle and 
use a cyclical redundancy check on the stream of tokens because doing so increases security in the 
system by providing a means to determine whether a file has been tampered with or otherwise has 
become corrupted since the CRC signature was generated and stored. 

20 Response to Arguments 

Applicant's arguments, see Remarks filed 5/22/06, with respect to the 102(a) rejection of claim 1 
have been fully considered but they are not persuasive. Applicant argues that Fermoyle does not 
disclose limitations a and b. However, Applicant's arguments fail to comply with 37 CFR 1 . 1 11 (b) 
because they amount to a general allegation that the claims define a patentable invention without 
25 specifically pointing out how the language of the claims patentably distinguishes them from the 
references. 
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At best, Applicant's arguments amount to a general assertion that keywords to be monitored by a 
computer cannot relate to language description data. However, Applicant gives no specific explanation 
as to how the claim language is believed to patentably distinguish over the Fermoyle reference, nor how 
Applicant's vague notion of "language description data" precludes the interpretation provided by 
5 Examiner. As such, Applicant's argument amounts to a general allegation not rendered in compliance 
with 37CFR 1.111(b). 

In addition, Applicant submits that Examiner has not specifically indicated which portion of 
Fermoyle is relied upon for limitation a. Examiner notes that it was indicated in the previous action that 
paragraph 8 was relied upon to teach limitation a (action mailed 1/20/06, page 2, four lines from the 
10 bottom). Even further, Examiner has indicated that the language description data may relate to keywords 
which are monitored by the detection data of the MailMarshal program. Thus, Examiner believes that a 
basis for the rejection has been indicated. Once again, Examiner notes that a proper argument for 
traversing this rejection must include not just a general contest but also a clear explanation pointing out 
how the language of the claims are believed to patentably distinguish over the references. 

15 

Applicant's arguments with respect to the 102(a) rejection of claim 4 have been fully considered, 

but they are not persuasive. Applicant submits that Examiner has noted with regard to the Fermoyle 

reference that keywords may relate to language description data. Applicant further submits that amended 

claim 4 now teaches that language description data relate to constructs. Applicant appears to argue that 

20 interpreting keywords as constructs would squarely conflict with Applicant's teachings of a construct, and 

as such the claims are patentably distinct. 

Examiner respectfully disagrees with such an argument for at least the reason that the 

Specification appears to teach that keywords may be constructs. Under the heading "Preparation of 

Language Description Data", the Specification teaches the following: 

25 "The constituent parts/constructs of a target script language include, for example, operator 

symbols (e.g., "+";=", etc.), identifiers (e.g., "x1","y2", etc.), delimiters (e.g., "{...}", "BEGIN... END", etc.), 
keywords (e.g., "IF ...THEN, "GOTO", etc.), numbers, blank spaces, etc)" (Specification page 7, line 29 
to page 8, line 2) 
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From at least the above, it appears that a keyword may be interpreted as a construct. 



Accordingly, Examiner maintains the rejection. 



Conclusion 



5 



Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 



action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of 
the extension of time policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 

1 0 of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 

shortened statutory period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the date of this final action. 

15 Any inquiry concerning this communication or earlier communications from the examiner should 

be directed to Kevin Schubert whose telephone number is (571) 272-4239. The examiner can normally 
be reached on M-F 7:30-6:00. If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. Information regarding 

20 the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) 

system. Status information for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 

25 free). If you would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



EMMANUEL L MOISE 
SUPERVISORY PATENT EXAMINER 




